find Command Cheat Sheet

find searches for files in a directory hierarchy. Unlike locate (which uses a database), find traverses the filesystem in real-time, making it slower but perfect for live state and complex filtering.

Synopsis

find [-H] [-L] [-P] [path...] [expression]

Basic Usage

Find by Name

Search for a specific file in the current directory (.) and subdirectories.

find . -name "config.xml"

Case Insensitive:

find . -iname "config.xml"

Find by Extension

find /home -name "*.jpg"

Filter by Type

# Find only directories named "build"
find . -type d -name "build"

Filter by Size

# Files larger than 100MB
find . -size +100M

# Files smaller than 10KB
find . -size -10k

# Files exactly 1GB
find . -size 1G

Filter by Time

find tracks three timelines: Access (a), Modification (m), and Change (c - metadata).

Signs matter: - +n: More than n (older) - -n: Less than n (newer) - n: Exactly n

# Modified more than 7 days ago
find . -mtime +7

# Modified in the last 24 hours
find . -mtime 0

# Accessed in the last 10 minutes
find . -amin -10

Filter by Permissions and Ownership

Permissions (-perm)

# Exact match (rarely used)
find . -perm 777

# At least these bits (common)
# Meaning: Look for files where user, group, AND others have read (4)
find . -perm -444

# Any of these bits
# Meaning: Look for files writable by group OR others
find . -perm /022

Ownership

find /var -user www-data
find /var -group nginx

Find files without owner (orphaned)

find / -nouser

Logical Operators

Combine expressions with AND, OR, NOT.

• ( expr ): Grouping (needs escaping \( ... \))
• ! expr or -not expr: Negation
• expr1 -a expr2: AND (implicit default)
• expr1 -o expr2: OR

# Files with .js extension AND NOT inside node_modules
find . -name "*.js" -not -path "./node_modules/*"

# Files that are either .jpg OR .png
find . \( -name "*.jpg" -o -name "*.png" \)

Actions: Doing Things with Results

By default, find uses -print. You can tell it to do more.

Execute Command (-exec)

Runs a command on each file found. {} is the placeholder for the filename. \; ends the command.

# Change permission of all .sh files
find . -name "*.sh" -exec chmod +x {} \;

Execute Efficiently (+)

Instead of running the command once per file, append filenames to the end (like xargs).

find . -name "*.log" -exec rm {} +

Delete Files (-delete)

Faster and safer than -exec rm. Implies -depth.

find /tmp -name "temp-*" -delete

Advanced Options

Limit Depth (-maxdepth)

Control how deep to search.

# Search only current folder (no recursion)
find . -maxdepth 1 -name "*.txt"

Empty Files

find . -type f -empty
find . -type d -empty

Practical Examples

Audit World-Writable Files

Security check to find risky files.

find / -type f -perm -002 2>/dev/null

Archive Logs Older than 30 Days

find /var/log -name "*.log" -mtime +30 -exec tar -rvf logs_backup.tar {} \;

Find Largest Files on System

find / -type f -exec du -h {} + 2>/dev/null | sort -hr | head -n 10

Tips

• Performance: Place cheap filters (like -name or -type) before expensive ones (like -exec or contents search).
• Whitespace: Use -print0 with xargs -0 to handle filenames with spaces correctly.